> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ankra.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# OVH API Credentials

> Store OVHcloud application keys, a consumer key with cloud-project rights, and a Public Cloud project in Ankra to provision OVH clusters and OVHcloud MKS.

OVH API credentials store an OVHcloud **application key**, **application secret**, **consumer key**, and Public Cloud **project ID**, used to provision and manage self-managed [OVH clusters](/guides/ovh-clusters) and [OVHcloud Managed Kubernetes (MKS)](/guides/ovh-mks-clusters). The credentials are validated when you save them - Ankra makes a signed read-only call to the OVH API (`GET /cloud/project/{project_id}/region`), so invalid keys or a consumer key without cloud-project rights are refused immediately.

## What Ankra Accesses

All calls are scoped to your Public Cloud project (`/cloud/project/{project_id}/...`) on the OVH EU API endpoint (`eu.api.ovh.com`). One credential covers both cluster types. For self-managed OVH clusters, Ankra provisions the infrastructure directly:

| Resource                             | Operations                          | Why it's used                                                                                |
| ------------------------------------ | ----------------------------------- | -------------------------------------------------------------------------------------------- |
| Instances                            | create, read, power actions, delete | The cluster's nodes and bastion                                                              |
| SSH keys                             | upload, read, delete                | Install your [SSH key credential](/platform/credentials/ssh-key) on the instances it creates |
| Private networks (vRack) and subnets | create, read, delete                | The cluster's private network                                                                |
| Cloud gateways                       | create, read, attach, delete        | Outbound internet access (egress NAT) for private nodes                                      |
| Flavors, images, public network      | read                                | Placement options in the cluster wizard                                                      |
| Operations                           | read                                | Poll long-running OVH operations to completion                                               |

For [OVHcloud MKS](/guides/ovh-mks-clusters), Ankra uses the managed Kubernetes API instead:

| Resource                      | Operations                   | Why it's used                                                        |
| ----------------------------- | ---------------------------- | -------------------------------------------------------------------- |
| Kubernetes clusters (`/kube`) | create, read, delete         | MKS cluster lifecycle                                                |
| Node pools                    | create, read, update, delete | Scale and manage the cluster's node pools                            |
| Kubeconfig                    | read                         | Connect Ankra's agent to the cluster                                 |
| Regions, versions, flavors    | read                         | Available regions, Kubernetes versions, and node sizes in the wizard |

## Creating OVH API Credentials

<Steps>
  <Step title="Generate OVH API credentials">
    1. Go to [https://api.ovh.com/createToken/](https://api.ovh.com/createToken/)
    2. Log in with your OVH account
    3. Set the following access rules - these are exactly what the validation checks and the tables above use:
       * **GET, POST, PUT, DELETE** on `/cloud/project/*`
       * **GET** on `/cloud/project`
    4. Click **Create Keys**
    5. Save the **Application Key**, **Application Secret**, and **Consumer Key**
  </Step>

  <Step title="Get your project ID">
    1. Log in to the [OVH Control Panel](https://www.ovh.com/manager/)
    2. Go to **Public Cloud** → select your project
    3. Copy the **Project ID** from the dashboard URL or project settings
  </Step>

  <Step title="Add to Ankra (UI)">
    Go to **Credentials** → **Add** → **OVH**, then provide:

    * **Name**: a unique identifier - lowercase letters and numbers only, cannot start with a hyphen (e.g. `ovh-prod`)
    * **Application Key**, **Application Secret**, **Consumer Key**: the keys from step 1
    * **Project ID**: from step 2

    Click **Test connection** to verify the keys against the OVH API, then save.
  </Step>

  <Step title="Or via CLI">
    ```bash theme={null}
    ankra credentials ovh create --name my-ovh-cred --project-id <project-id>
    # You will be securely prompted for application key, application secret, and consumer key
    ```
  </Step>
</Steps>

For self-managed OVH clusters you also need an [SSH key credential](/platform/credentials/ssh-key).

<Note>
  The application key, application secret, and consumer key can be rotated later from the credential's page. The **project ID is fixed** - to target a different Public Cloud project, create a new credential.
</Note>

## Listing OVH Credentials

<CodeGroup>
  ```bash CLI theme={null}
  ankra credentials ovh list
  ```

  ```bash cURL theme={null}
  curl https://platform.ankra.app/api/v1/credentials/ovh \
    -H "Authorization: Bearer $ANKRA_API_TOKEN"
  ```
</CodeGroup>

## Troubleshooting OVH Credentials

The table below covers the **Test connection** result in the Ankra UI:

| Test connection result                                                     | Cause                                                                          | Solution                                                                                                  |
| -------------------------------------------------------------------------- | ------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------- |
| OVH rejected the supplied keys.                                            | The application key, application secret, or consumer key is invalid or revoked | Regenerate the keys at [api.ovh.com/createToken](https://api.ovh.com/createToken/) and re-enter all three |
| OVH accepted the keys but the consumer key lacks the required permissions. | The consumer key's access rules don't cover cloud-project resources            | Regenerate with **GET, POST, PUT, DELETE** on `/cloud/project/*` and **GET** on `/cloud/project`          |
| Could not reach the OVH API.                                               | Network or connectivity issue                                                  | Retry; ensure outbound access to `eu.api.ovh.com`                                                         |
| OVH returned HTTP `<code>`.                                                | Unexpected OVH-side response, or a wrong project ID                            | Check the **Project ID** matches your Public Cloud project exactly, then retry                            |

Saving without testing runs the same validation and reports the same causes - for a permissions failure the save error spells out the exact access rules to regenerate with.

Consumer keys can also expire if you set a validity period at creation. If a credential that used to work starts failing with rejected keys, regenerate at [api.ovh.com/createToken](https://api.ovh.com/createToken/) (with unlimited validity if your policy allows) and rotate the three keys in on the credential's page.